fix: vulnerabilità minori

Author: Pek5892

actions.php

@@ -338,7 +338,8 @@
 
 // Gestione ordine per le checklist
 elseif (filter('op') == 'ordina-checks') {
-    $ids = explode(',', $_POST['order']);
+    $order_data = post('order', true);
+    $ids = $order_data ? explode(',', $order_data) : [];
     $order = 0;
 
     foreach ($ids as $id) {
@@ -365,8 +366,8 @@
     }
 
     // Contenuti
-    $mail->subject = $_POST['subject'];
-    $mail->content = $_POST['body']; // post('body', true);
+    $mail->subject = post('subject');
+    $mail->content = post('body', true);
 
     // Conferma di lettura
     $mail->read_notify = post('read_notify');

include/init/configuration.php

@@ -155,7 +155,10 @@
         // Laravel non è inizializzato in questo contesto
         // use Illuminate\Support\Facades\Artisan;
         // Artisan::call('key:generate');
-        shell_exec('php artisan key:generate');
+        $artisan_path = escapeshellcmd('php');
+        $artisan_cmd = escapeshellarg('artisan');
+        $key_generate_cmd = escapeshellarg('key:generate');
+        shell_exec($artisan_path.' '.$artisan_cmd.' '.$key_generate_cmd);
 
         if (!$creation) {
             echo '

modules/contratti/row-list.php

@@ -786,7 +786,7 @@ function apriDocumenti(div) {
 
 function modificaIvaRighe(righe) {
     if (righe.length > 0) {
-        openModal("'.tr('Modifica IVA').'", "'.$module->fileurl('modals/modifica_iva.php').'?id_module=" + globals.id_module + "&id_record=" + globals.id_record + "&righe=" + righe.join(','));
+        openModal("'.tr('Modifica IVA').'", globals.rootdir + "/include/modifica_iva.php?id_module=" + globals.id_module + "&id_record=" + globals.id_record + "&tipo_documento=contratti&righe=" + righe.join(','));
     }
 }
 

oauth2_login.php

@@ -24,8 +24,8 @@
 include_once __DIR__.'/core.php';
 
 // Authorization information
-$state = $_GET['state'];
-$code = $_GET['code'];
+$state = get('state');
+$code = get('code');
 
 // Account individuato via state
 if (!empty($state)) {
@@ -70,6 +70,6 @@
 
     exit;
 }
-echo strip_tags($_GET['error']).'<br>'.strip_tags($_GET['error_description']).'
+echo strip_tags(get('error')).'<br>'.strip_tags(get('error_description')).'
 <br><br>
 <a href="'.$redirect.'">'.tr('Riprova').'</a>';

src/Util/XML.php

@@ -96,13 +96,15 @@ public static function decodeP7M($file)
         $output_file = $directory.'/'.basename($file, '.p7m');
 
         // Validate that file path doesn't contain shell metacharacters
-        if (preg_match('/[;&|`$(){}\\[\\]<>]/', $file)) {
+        if (preg_match('/[;&|`$(){}\\[\\]<>]/', $file) || preg_match('/[;&|`$(){}\\[\\]<>]/', $output_file)) {
             throw new \Exception('Invalid file path');
         }
 
         try {
             if (function_exists('exec')) {
-                exec('openssl smime -verify -noverify -in "'.$file.'" -inform DER -out "'.$output_file.'"', $output, $cmd);
+                $escaped_file = escapeshellarg($file);
+                $escaped_output = escapeshellarg($output_file);
+                exec('openssl smime -verify -noverify -in '.$escaped_file.' -inform DER -out '.$escaped_output, $output, $cmd);
 
                 if (!file_exists($output_file)) {
                     $signer = $directory.'/signer';